Embedded Software & Firmware Development Services

Decision is driven by hardware budget, real-time requirements, regulatory profile and field-update strategy. Bare-metal (no scheduler) when you have a single tight control loop on a Cortex-M0/M0+, sub-kilobyte RAM, and battery life is the dominant concern — typical for sensors and BLE peripherals. Zephyr RTOS when you need a real-time scheduler, networking stack (TCP/IP, BLE, Thread, Matter), multiple concurrent tasks, but RAM budget is 32–512 KB and you want a Linux Foundation-governed project with long-term support. FreeRTOS for legacy stacks and where Amazon FreeRTOS / AWS IoT integration is required. Embedded Linux via Yocto (or Buildroot for smaller systems) when you have an application processor (Cortex-A / RISC-V), ≥64 MB RAM, need a full network stack, container runtime, or third-party libraries that assume POSIX.

Both, with strong preference for the latter as a starting point. We start from the silicon vendor's reference Yocto layer (meta-st-stm32mp, meta-ti, meta-imx, meta-nxp, meta-raspberrypi, meta-rockchip, etc.) and build a custom meta-layer for your product. Recipes are version-pinned to a Yocto LTS release (Kirkstone / Scarthgap), bitbake builds run reproducibly in CI (GitLab or GitHub Actions with sstate caching on S3 — without sstate caching a clean Yocto build is 90 minutes of pure CI cost). We deliver a SDK so your application team can cross-compile without touching the BSP, and we maintain the layer as part of the engagement.

MISRA C:2012 (with Amendment 3 directives) is our default static-analysis baseline on every embedded engagement — enforced via PC-lint Plus, Cppcheck Premium, or Coverity in CI with deviations documented and reviewed. For medical devices we deliver against IEC 62304 (software lifecycle for medical device software) with full traceability from requirements through design, code and unit/integration tests in DOORS or Polarion; we have shipped Class B and supported Class C audits. For automotive we work to ISO 26262 ASIL-B and contribute to ASIL-D safety cases under a functional safety manager. For industrial we handle IEC 61508 SIL-2. We do not self-certify — independent assessor sign-off is your audit body, we prepare the evidence.

OTA is designed before silicon is chosen — late-stage OTA retrofits are how fleets get bricked. Embedded Linux uses A/B partitioning (RAUC, Mender, or SWUpdate) with atomic rollback on boot failure, signed update bundles (typically ed25519 or ECDSA P-256), and a delta-update mechanism for cellular-constrained devices. RTOS devices use MCUboot for secondary-slot updates with image signing and anti-rollback counters. Backend is your own or hyperscale IoT (AWS IoT Device Management, Azure Device Update for IoT Hub, Mender server). We design the staged rollout policy (canary → 1% → 10% → 100%) and the field-failure recovery path before first production unit ships.

BLE 5.x via Zephyr's stack on Nordic nRF52/nRF53/nRF54 and Silicon Labs EFR32, or SoftDevice when vendor-specific certifications require it. Matter (formerly Project CHIP) via the official open-source Matter SDK on Thread (OpenThread) or Wi-Fi transport — we have shipped commissioned Matter-over-Thread devices through CSA certification. LoRaWAN via the Semtech LoRaMAC-node stack on STM32WL or SX126x companion chips, with TTN / ChirpStack backends. Sub-GHz proprietary protocols (Wi-SUN, Z-Wave) where the use case justifies the BOM cost. We do regulatory pre-scan (FCC Part 15, CE RED, MIC) before tape-out and coordinate full lab certification with a partner (TÜV, Element, Eurofins).

Embedded and IoT work is fixed-scope and tiered by IoT maturity, all-in and quoted in USD. An IoT MVP runs from $3,500 (first working connected device: one core function, firmware, basic connectivity); device management from $5,800 (signed A/B OTA with rollback, provisioning, remote config); telemetry with a dashboard from $9,200 (sensor ingestion, cloud backend, monitoring dashboard, alerts); a full IoT platform from $11,500 (multi-device management, roles, integrations, safety evidence, CI on real hardware). The exact number depends on your regulatory profile (IEC 62304, ISO 26262, IEC 61508), RTOS-vs-Embedded-Linux scope, radio and connectivity certification (FCC Part 15, CE RED for BLE / Matter / LoRaWAN) and silicon maturity. You see the line-item budget after a free scope assessment and sign off before any code is written. Source, BSP and Yocto layers live in your repos from day one; production hand-off includes manufacturing test fixtures, the Yocto SDK and a CI release pipeline — no recruitment markup, no tool surcharges, and regulatory lab-certification fees run on your own accounts.

Yes — brownfield takeover is a large share of our embedded work. We start with a firmware audit: build reproducibility (can we rebuild your exact shipping binary from source?), toolchain and SDK version pinning, a MISRA C:2012 static-analysis baseline to quantify existing debt, and a review of the OTA, secure-boot and secrets-handling design. You get a written findings report with a risk-ranked remediation plan before we touch a line of code. Common triggers are an original vendor or contractor who has gone dark, a Yocto BSP frozen on an end-of-life kernel, or a device that needs EU Cyber Resilience Act compliance it was never designed for. We can also do the audit as a standalone engagement without committing to the rebuild.

We are a firmware and embedded-software house, not a PCB design bureau — but we do not work in isolation from the hardware. We drive silicon selection (MCU/SoC shortlist with BOM cost and active/sleep power budgets), review your schematic and pin-mux from a firmware-feasibility angle, and write bring-up and manufacturing-test firmware for the board. For the physical PCB layout, RF matching and EMC design we work alongside your EE team or one of our hardware partners, and we own the software boundary end to end: BSP, bootloader, drivers, application firmware and OTA. If you arrive with a dev board and a datasheet, that is a normal starting point.

Power is a design constraint from week one, not a late-stage tuning pass. We build an energy budget on real silicon — measured active, idle and deep-sleep currents with a power analyzer (Otii, Nordic PPK2 or lab equipment), not datasheet typicals. Firmware is architected around the lowest viable sleep state: peripheral clock gating, DMA instead of CPU polling, event-driven wake rather than busy loops, and radio duty-cycling (BLE connection-interval and advertising tuning, or store-and-forward on cellular). We give you a projected battery-life figure tied to a defined usage profile and validate it against a real coin cell or pack, because a device that meets its power spec on paper and fails in the field is a recall waiting to happen.

Security is designed in, with the EU Cyber Resilience Act as the baseline for connected devices sold into the EU. We implement a secure-boot chain with the root-of-trust in OTP/eFuse, signed firmware images (ed25519 or ECDSA P-256) with anti-rollback counters, and encrypted-at-rest secrets via the SoC secure element, HSM or TPM. OTA bundles are signed and verified before they are applied. On the process side you get an SBOM, a documented threat model, a vulnerability-disclosure policy and a security-update commitment — the artefacts a CRA conformity assessment asks for. Key provisioning and injection happen in a controlled manufacturing workflow so private keys never live in the source tree. For medical and automotive work this dovetails with the IEC 62304 / ISO 26262 evidence trail rather than sitting beside it.